Air France leaves passenger with dead parent stranded in Paris - <AUTHOR> http://jayharishshah.blogspot.com/2013/10/one-night-in-paris.html

<comment><USER3> I have no sympathy whatsoever for the writer ... Calling someone a "walking abortion" or claiming they're missing their cerebelum is uncalled for regardless of the circumstance.

With the tone of this whole post, I'd love to imagine that the writer was himself an Air France gate agent. I don't think customer service would be his forte.

<comment><AUTHOR> he is just upset and expressing himself after a painful ordeal. I'm sure that wasn't what he said to the guys at the gate. In fact his frustration stems from the fact that he was dealt with so badly - which to me implies that he has a different understanding of what customer serviceshould be like. Anyways - dont waste your time making ad hominem comments - the point was that Air France treats people like crap - so unless you have to fly with them - <USER2> another airline.

</comment></comment><comment><USER4> I can feel the pain and frustration you might have been through, for I landed up in something similar.

Early this year, we flew Lufthansa from Delhi (India) and were stranded at the Munich airport. None of us got the transit visas, no food, they switched off the air-conditioning in the night, no blankets - just plain sheets when it was snowing outside. Lufthansa flew knowing there was no connecting flight left at Munich to not loose the booking. Adding insult to injury, they lost most of our baggage. On return flight, despite confirmed veg meal bookings - none of us got it on a flight lasting 12 hours. You know the best part, we were 70+ people on a corporate booking.

Its the same everywhere in Europe - may be it's their culture.

</comment><comment><USER5> You have a contract with the airline. They have to take you to your destination and, in case things go wrong, there are laws that mandate what they _must_ do extra. You will save yourself a lot of grief if you don't expect the airline to do you _any_ favours outside of the contract/laws (e.g. preferential treatment for passengers with dead parents).

That said, I fully support asking for your rights (in court, if needed) and publicly calling them out for bad service -- the latter is the one thing _after_ their profit statement that will get the company interested in improving everyone's experience by going the extra mile.

</comment><comment><USER6> _He is infuriated and with an overcompensating display of anger points out the only two things I am supposed to have as per the voucher._

It's interesting- before we were married, my wife visited Paris, and someone in her party tried to have two croissants, instead of one, for breakfast at their hotel and was rather rudely told "only one!". It could be a convention in France, that one is strictly required to stick to the menu. For people from the third world (South Africa in our case) the inflexibility of First-World rules sometimes comes as a bit of a shock.

<comment><USER7> Really, this is not as much as "rules of the first world" as probably old people stubbornness (either the attendant or the owner most likely)

Another thing would that he would be obliged to ring a drink+pastry and match that with the voucher, so if it doesn't match he doesn't get payed.

But what happened to your wife is probably common, one of the reasons I pick "chain" hotels so something similar is less likely.

</comment></comment><comment><USER8> Feel sorry to hear your ordeal, however i am glad you are following it up with court summons. Please do write up a follow up article regarding this as and when you can

</comment><comment><USER7> Yes, they should have picked another aircraft to do the flight, especially since it's their hub.

But some schedules are tight, and there may not have been a free aircraft that day

<comment><USER9> It's very possible that Air France couldn't have them on a plane sooner. This can happen. But Air France would be smart to communicate this more clearly. It's bad enough having to be stranded somewhere, but to leave your passengers -- which paid you to be taken from point A to point B -- wondering if and when anything is going to happen is not a very good idea in my opinion. This whole story would not have been written if they'd had that in order.</comment></comment>


Single workers aren't there to pick up the slack for their married colleagues - <AUTHOR> https://qz.com/991030/your-single-coworkers-and-employees-arent-there-to-pick-up-the-slack-for-married-people/ <comment><USER2> My first thought was that this would be whiney, but the author lays it out in detail and makes a lot of great points.

<comment><USER3> The style is OK, but it _is_ whining. By definition, it can't be anything else. "I want all the perks of being single, but I envy perks of being married". All arguments are single-sided, some are wrong (correlation does not imply causation), most short-sighted. It pretty much defines just another oppressed minority. Because everyone should have a chance to be a victim of oppressive patriarchy! Unless of course, you are a white, straight, married white male that has a family, in which case you are irremediable.

One that got me irritated most was:

> Workplace celebrations of employees who are engaged or about to parent a > child may be motivated by the kindest of sentiments, but they are painful to > those who only wish they had such experiences

Yes. The world should be a gray, boring, nothingness just so no oversensitive, envious person ever felt offended or left out. Such a typical modern mainstream narrative. :D

I'm not going to get into more discussion as I don't have time, and I feer enraging some PC police somewhere.</comment></comment>


Next.js 8 released - <AUTHOR> https://nextjs.org/blog/next-8 <comment><USER2> Next.js is an awesome framework, but dynamic routing is still a mess, and clean URL masking [0] is unnecessary complicated: you have to add a route handler to Express.js, and you have to use 2 different props to your <Link> components to make it work.

The Next team explains it because they don't want to solve this problem by shipping a definition of all the route of the app [1] because it does not scale. But while it is true, it makes dynamic routes extremely painful to use. Hopefully it will be fixed soon.

Another thing not mentioned in the blog post is they started to rewrite the core of Next.js in TypeScript too, which is a big move!

      [0] https://nextjs.org/learn/basics/clean-urls-with-route-masking
      [1] https://github.com/zeit/next.js/issues/4989#issuecomment-442024894

<comment><USER3> We are using `next-routes` and they are working really well for us.

<comment><USER4> next-routes is good, but it was unmaintained for a long time, with issues and PRs (27 at the time of writing!) piling up. A new maintainer was just added [1] who seems more active, so hopefully things will improve.

[1] [https://github.com/fridays/next- routes/issues/244#issuecomme...](https://github.com/fridays/next- routes/issues/244#issuecomment-461482668)

<comment><USER3> Almost all of them are just version bumps. We wasn't needed anything for a year of usage.

</comment></comment></comment></comment><comment><USER5> What I don't get: Either you go full SPA _or_ SSR. And If you go for latter then you can choose any stack, e.g. Rails, express with pug, Django, PHP, etc. Why do people take React's constraints to the backend? No bashing, really wondering what's so much better then. I know why a React SPA can be better than a SSR. But what is better about a React SSR vs the typical SSR?

<comment><USER6> SPA? SSR?

<comment><USER7> SPA = Single Page App SSR = Server Side Rendered

SPAs run in the browser, therefore they must be written in JavaScript (or something that compiles to it.)

SPAs have the drawback of having to load a bunch of JavaScript before rendering anything, so the initial page load tends to be slow. Next.js gets around this by performing SSR for the initial page view, and then you're already looking at that page while all of the JS loads to render subsequent pages.

<comment><USER8> The term 'SPA' is a little outdated - since HTML5 history (which is nearly a decade old now) most 'SPAs' are actually multiple pages.

'web apps' is better.

</comment></comment></comment></comment><comment><USER9> I've been using Next.js for a fairly big e-commerce project for a client, and I have to say it's great.

The framework itself makes working with a React, universal rendering app much easier than other solutions I've worked with. It's doing a great job at starting very small while at the same time extending for your needs is pretty easy for most things (such as build configs, custom server, etc).

The community is growing and very helpful too.

I'm very glad to see it continue to move so fast and definitely already see it as a very strong option and probably becoming the de-facto solution for JS apps, just how Rails or Django are to Ruby and Python.

Thanks to the team for the great work :)

edit: typos

<comment><USER10> It's great but not becoming the de-facto. I believe Gatsby is on that path, in terms of popularity they seem to be ahead.

<comment><USER11> I thought Gatsby is a static site generator?

<comment> toper-centage Yes and in that sense it overlaps next a bit... But next is much more.

<comment><USER11> In the way that Jekyll and Rails overlap?

</comment></comment></comment></comment></comment><comment><USER12> Holy crap, these pages load fast. Honestly the best possible advertisement for a javascript framework at the moment is how quickly the page paints. For me it was virtually instantaneous. Bravo.

<comment><USER13> I'm behind a mobile connection which has been acting up today. For me the experience on the website was pretty bad, as there were no loading indicators. I clicked on a link and it did nothing for several seconds. Since it's not a real page load, my browser did not show any indication of loading either.

I'm not entirely sure what next.js does, but I would be wary of using this library due to the bad website experience on a non-optimal connection.

<comment><USER14> Loading indicators are left up for developers to add in next.js, but aren't very difficult to do.

I've used react-redux-loading-bar[1] in a recent small project of mine and it worked quite well so far.

I'm not sure about working with the native loading indicators though.

In general I quite like the way next.js is handling these things: It's pretty bare-bone but provides _a lot_ of examples of how to do more advanced things.[2]

There's even an example for loading indicators: [https://github.com/zeit/next.js/tree/canary/examples/with- lo...](https://github.com/zeit/next.js/tree/canary/examples/with-loading)

[1] [https://github.com/mironov/react-redux-loading- bar](https://github.com/mironov/react-redux-loading-bar) [2] [https://github.com/zeit/next.js/tree/canary/examples](https://github.com/zeit/next.js/tree/canary/examples)

<comment><USER15> Great explanation @mAritz!

Thank you for your feedback @Ndymium, we've shipped a new version of the website that has a loading indication (based on the with-loading example posted above)

</comment></comment></comment></comment><comment><USER5> Interesting read from Dec 2018 [1] about Next.js:

 _SSR throughput of your server is significantly less than CSR throughput. For react in particular, the throughput impact is extremely large. ReactDOMServer.renderToString is a synchronous CPU bound call, which holds the event loop, which means the server will not be able to process any other request till ReactDOMServer.renderToString completes.

[...]

Using Pre-Rendered CRA addresses both the SEO and performance concerns around using CRA without the complexity that Next.js introduces_

[1] [https://codeburst.io/next-js-ssr-vs-create-react-app- csr-745...](https://codeburst.io/next-js-ssr-vs-create-react-app- csr-7452f71599f6)

<comment><USER16> Acronym translations:

       SSR: Server-side rendering
       CSR: Client-side rendering
       CRA: create-react-app

</comment></comment><comment><USER17> Here's the PR to Webpack:

[https://github.com/webpack/webpack/pull/8609](https://github.com/webpack/webpack/pull/8609)

</comment><comment><USER18> @zeit employees are some really talented developers

</comment><comment><USER19> Interested to see serverless as part of a web framework. My understanding was AWS Lambda and similar platforms were best for asynchronous workloads, but for web stuff the cold start could be too long for things to feel snappy. Has that changed recently?

<comment><USER15> It actually works really well for render workloads like server-side rendering too, the reason for this is that rendering can be quite expensive and blocks the thread. With Serverless you're able to scale the renderer to infinite instances.

The cold-boot problem is an interesting one, it's heavily correlated to the serverless function size, this is why we implemented a complete output target for serverless, to output the smallest possible function that is completely standalone, no dependencies. This makes cold-boot considerably faster. For example on [https://next-news.now.sh/](https://next-news.now.sh/) it's hard to tell the difference between cold-boot and warm functions.

<comment><USER19> That's interesting thanks - I didn't know this. And thanks for the example site too! Definitely feels snappier than I anticipated.

</comment></comment></comment><comment><USER20> One concern on mobile where I find the scrolling is not respond for a second or longer whenever I swipe back to previous page in Safari, applicable in some of the showcases in Next.js too, is it the expected user experience?

<comment><USER21> People are calling out the routing issues specific to next.js ... I am not using that, but am using react with redux and routing (connected-react-router) and haven't experienced the types of issue you mention. Though many on here point out that next.js routing is a major shortcoming.

</comment></comment><comment><USER18> If you are going to use it as a static site generator, you should also try Hugo + the Mainroad theme, generated files are super light and easy to style as you wish.

</comment><comment><USER22> So the tutorial requires me to login with github? Sorry, not gonna happen.

<comment><USER23> You can still access the content without logging in, just use the navigation on the left rather than clicking on "login & start". It does feel pretty aggressive of them to want you to log in.

<comment><USER24> The content that is accessible through the navigation seams to be only a teaser for the content that is hidden behind the login.

</comment></comment></comment><comment><USER25> How similar is this with Nuxt.js?

<comment><USER26> Next predates Nuxt, so Nuxt was inspired by Next.

Next = SSR + React Nuxt = SSR + Vue.js

<comment><USER25> thank you, this helps. The question comes because I do not have a handle on react.js and I do know something about Vue.js.</comment></comment></comment>


How to track costs in multi-tenant Amazon EKS clusters - <AUTHOR> https://aws.amazon.com/blogs/containers/how-to-track-costs-in-multi-tenant-amazon-eks-clusters-using-kubecost/ <comment><USER2> Another way to do that is to buy commercial SaaS vendor monitor AWS costs: CloudHealth or Cloudability.

<comment><USER3> There would be a number of differences with these products. First, Kubecost does not egress any data from your infrastructure, it's based on open source technologies (e.g. Prometheus), and because it is build specifically for Kubernetes it takes a pretty different approach for determining the cost of a tenant, workload, etc.

Disclaimer: I'm a founder of Kubecost.

<comment><USER4> Congrats on being the founder.

>The default installation of Kubecost includes an optimized Prometheus server that only contains metrics that are useful to Kubecost. This optimized version retains 70-90% fewer metrics than a standard Prometheus deployment. You can also use an existing Prometheus installation.

I really like this approach. What do customers say about it?

<comment><USER3> Thanks, simonebrunozzi!

With a growing number of teams using Prometheus-based observability solutions, we've seen more and more integrating Kubecost with their existing Prometheus. The majority still use our bundled offering, which is typically a little easier to setup, but many likely the flexibility to switch if desired.

</comment></comment></comment></comment><comment><USER5> Is there any way to setup a sharding solution for Prometheus? Like instances per AZ or that only scrape a certain set of nodes? On our larger clusters we had issues even with the optimized Prometheus instance in kubecost, and it's starting to look like metrics collection/processing may be a big driving force on our cluster scaling designs.

<comment><AUTHOR> There's definitely ways to do this by configuring your scrape configs to ignore sets of nodes. Curious though when you last tried kubecost out? We've built out some caching mechanisms in the product over the last month or so that should dramatically reduce load / memory consumption on prometheus. If you reach out on our slack kubecost.slack.com we can discuss more about expected Prometheus resource consumption.</comment></comment>


10c.im - anonymous, intellectual group chat about thought-provoking topics - <AUTHOR> http://www.10c.im

<comment><USER2> The only thing I regret is that valuable thoughts go to waste, in the sense that, since they're not stored, they can not be endlessly discussed, improved and ultimately result in real solutions.

For me any discussion has the ultimate goal of improving things. Even if it takes a long time.

I tried to explain that here, regarding only 1 specific topic: [https://news.ycombinator.com/item?id=6152935](https://news.ycombinator.com/item?id=6152935)</comment>


Bitcoin Is in the Dumps, Spreading Gloom over Crypto World - <AUTHOR> https://www.wsj.com/articles/bitcoin-is-in-the-dumps-spreading-gloom-over-crypto-world-11552927208 <comment><USER2> Paywall. And not informative.</comment>


The Day Series: The Day I let my first employee go - <AUTHOR> http://thedayseries.com/post/592577257/the-day-i-let-my-first-employee-go

<comment><USER2> Is there a case where it does makes sense to put write off salary as loans to the founders? As the OP indicated, any sophisticated investor would insist all the money goes "forward." But even if the company bootstrapped it to profitability, there would be no difference in tax due using this accounting practice, is there?

Is there any advantage at all to doing it this way?

<comment><USER3> I think you have it the wrong way around.

Their salary was $100k, of which (say) $80k was returned as a loan from the founder to the company.

This lets the company book $100k of costs on a net cash outflow of $20k. Costs are applied before calculating profit and therefore before calculating taxation due. At a corporate tax rate of 20% that would be worth $16k more than the tax deduction due from paying salaries of $20k.

Tax losses can be deferred until you make a profit in most tax regimes so that $16k will be held over until you need it to avoid paying taxes on the first $80k of corporate profits no matter when they happen.

It may also be possible to essentially sell tax savings to other companies under some circumstances (usually when winding up a company).

Overall this scheme would probably cost money as employment taxes would be due. But that can vary depending on other tax breaks, especially in progressive taxation systems. You may also be able to do something interesting with loan interest repayments which are often subject to tax breaks. Tax codes for Western countries are huge and full of interesting possibilities!

<comment><USER4> It's good for the company, that makes sense.

What I don't get is, if you pay yourself $100K, aren't you personally taxed on your 100K income?

Or, will you claim you only had a 100K - 80K = 20K income on your personal taxes? I would think the government would try to match up the $100K company expense with a $100K personal income (and if they don't match, audit you).

I'm actually really curious if you can pull this kind of thing off.

<comment><AUTHOR> My position is that the salaries were really just our egos. We didn't have the money to pay ourselves over $100k. The $20k "example" is actually pretty close.

Ideally, take what you can to pay your mortgage. Put that on the books. Spend time getting profitable instead of balancing the books. If you become profitable, or get a nice round, it'll all work out :)

</comment></comment></comment></comment><comment><USER5> _He was even nice enough to proofread this post for me. This was a startup. CJ new that._

Heh.

<comment><AUTHOR> sweet, sweet revenge... :)

been fixed. thanks.

</comment></comment><comment><USER6> Great post that brought back some memories. In 2001 I was hired by a startup that was in a very similar situation. When they ran out of cash 5 months later I could tell it was much harder on the founder than it was on me, since not only did he need to let me go but his startup dream was ending. He let me continue to use the machines until the doors finally closed, and I ended up landing a good contract position all negotiated from that very equipment.

</comment><comment><USER7> Has CJ found a new gig yet, or is he in need? I know there's a handful of companies out there that need bright engineers for their startup.

<comment><AUTHOR> Well this was two years ago, so by now he's doing well. Feel free to get at him @waltz though, I'll update the post. Thanks!</comment></comment>


Google, once disdainful of lobbying, now a master of Washington influence - <AUTHOR> http://www.washingtonpost.com/politics/how-google-is-transforming-power-and-politicsgoogle-once-disdainful-of-lobbying-now-a-master-of-washington-influence/2014/04/12/51648b92-b4d3-11e3-8cb6-284052554d74_story.html?tid=ts_carousel <comment><USER3> There is a lot of misinformation about lobbying. My wife used to be a lobbyist, so let me dispel some myths:

1) Lobbyists costs a lot of money. The amount Facebook spent on WhatsApp is equivalent to fifty times the annual lobbying revenues of the top 10 DC lobbying firms combined.

2) Lobbying money goes to politicians pockets. American politicians are some of the most thoroughly scrutinized on the planet. Lobbying money doesn't go under the table to some politician. It usually doesn't even go to campaign contributions. The major source of campaign contributions is rich peolple making personal donations, not lobbyists. Lobbying money goes towards advocacy. For example, a lobbyist might commission a survey to show a politician that a particular position, advantageous to a client, is politically popular. They may also propose draft legislation, connect politicians with experts, etc. What Google is doing is a good example of the bread and butter of lobbying: simply helping politicians understand the prevailing point of view of an industry.

3) Lobbying is the same as corruption. The vast majority of lobbying is about helping politicians find votes. Its about showing how what's good for an industry is good for constituents. The message is overwhelmingly not "if you vote for this, there is money in it for you" but "voting for this will save 100 jobs in your district."

Do lobbyists help corporations exercise substantial political power? Yes. But most of the american labor force works for large corporations. Their livelihoods and that of their kids depend on these corporations. Their healthcare and retirement depend on them. Corporations don't need to corrupt the political system to wield power.

<comment><USER4> Do lobbyists spend money to influence politicians? Yes? Then it's corruption.

Private money - whether it be from rich people or large corporations - <USER2> have no place in politics. The vote of a poor single mother working two jobs to only barely feed her children should carry just as much weight as that of a rich tycoon. If you believe that money should institutionally equate to influence, then you do not believe in equality.

<comment><USER3> Without money, advocacy is merely the expression of sentiment, and sentiment is a valueless currency in the modern world.

One the issues near to my heart is environmental protection. The advancements made in environmental protection over the last 50 years have all been accomplished through the expenditure of money. It costs very little money to convince people to adhere to the old ways. It costs no money to convince West Virginians that coal and coal mining is good. It costs no money to convince Oregonians that logging is good. Commissioning studies to show that the health damage from coal mining would double the price of coal if accounted for? Making movies to help people visualize the catastrophe of strip mining? That costs money.

What irks me the most about liberals' opposition to Citizens United is their failure to realize that money being speech helps them more than it helps conservatives. It costs very little money to promote conservatism. People are predisposed to wanting to preserve the status quo. Its those that oppose the status quo that benefit the most from high profile advocacy. The opposition of the tech industry to surveillance Is the paradigmatic example of this phenomenon. The tech industry will have to spend a lot more money on advocacy to move forward from cold war era views then defense contractors will spend to defend the status quo.

<comment><USER5> > It costs very little money to promote conservatism.

Perhaps in theory, but in practice a lot of money is spent on it.

</comment></comment></comment></comment><comment><USER6> This thread so far has been pretty disappointing, reacting to the headline only, slashdot-style. The article is actually a pretty interesting look at what it takes to get people in Washington to start considering a different point of view, for good or ill.

The interesting part of that is that it's completely reasonable that you have to get people thinking about things like how a search engine should function in a free market (beholden to the users, not the businesses it finds for them), but when it comes down to it, doing that is also fundamentally paying money to buy influence (even if that influence is just "that position now seems reasonable to me"). My initial reaction is to find lobbying distasteful in the same way I find marketing distasteful. An idea or product should stand on its own merits. Of course, it never works out that way: you might want to be noble and not introduce a new bias into the public, but people already have a host of biases, and to get them to even consider something new, you often have to help them get there.

The emails they got under a FOIA request are also interesting in that light[1]. The Post tries a bit to make them sound somewhat scandalous, and I know we're trained by the media to only be interested in smoking guns, but it's interesting in precisely how mundane and completely reasonable lobbying can be, while still being about shaping the entire dialog to be more favorable.

That said, there are some really bad parts here too, like describing SOPA as

> _" And, in what Google saw as a direct threat to the open Internet, major > lobbies such as the U.S. Chamber of Commerce and the Motion Picture > Association of America were mounting a legislative campaign to place > restrictions on the sale of pirated music and movies."_

ugh. Kind of weird, too, as in the past the Washington Post has given good coverage of SOPA protests and why anyone would be protesting it...

[1] [http://www.washingtonpost.com/news/politics/2014/04/12/how-g...](http://www.washingtonpost.com/news/politics/2014/04/12/how- google-worked-behind-the-scenes-to-invite-federal-regulators-to-conferences/)

<comment><USER7> 1) Good lobbying: Google lobbies congress to allow self driving cars in all 50 states. _result: good because its asking for permission not taxpayer handouts, consumers pay the entity through supply and demand not taxes_

2) Grey area lobbying: Light rail manufacturers lobbied congress to increase federal spending to help with light rail projects across America. _result: uses taxpayer dollars, might increase light rail projects in areas where it isn 't needed, takes tax payer dollars and transfers them to the entity doing the lobbying_

3) Bad lobbying: Chrysler, GM, & Ford lobbied congress to lower the fuel efficiency standard (MPG) and prevent increases. _result: screwed themselves over because in the long run they could no longer compete fuel consumption wise with foreign auto makers and had to be bailed out_

Most people don't understand that lobbying is a tool. It can be used to enact laws that benefit or hurt different groups of people. It's more talked about when it does bad so people assume all lobbying is bad. Same with "bacteria", "fat" and "cholesterol".

<comment><USER3> One point about "good lobbying" though. Often, "bad lobbying" takes the guise of "good lobbying." Imagine a coal company lobbying to loosen air pollution controls, to leave to the market the decision of whether cheaper electricity or cleaner air is more valuable. It is easy to disguise permission to externalize negative effects as simply permission to let the market decide.

</comment></comment></comment><comment><USER8> As a non-american, can anybody explain to me how "lobbying", defined as "spending money to 'influence' public representatives in the favor of a private entity", differs from the old-school concept of "corruption"?

I'm genuinely interested.

<comment><USER9> Corruption: You give money, etc., _to_ the public representative to influence their action.

Petition: You expend resources to advocate your views to a public representative.

Lobbying: You expend resources to have a third party advocate your views to a public representative.

Lobbying is a form of _petition_. It sometimes draws attention because corruption becomes a technique -- just as is the case sometimes with _direct_ petition -- but it is as different from corruption as direct petition is.

<comment><USER10> Well, many lobbyists advocate your views by giving money, goods or services to public representatives... but I suppose it is distinct in that you are not the one directly offering the bribes and 'favors'.

<comment><USER9> > Well, many lobbyists advocate your views by giving money, goods or services > to public representatives...

Sure, that's a tactic that happens in lobbying, just as its a tactic that happens in people _directly_ advocating their own views.

I am not saying that lobbying is free of corruption. But the reason the two often go together isn't that lobbying is fundamentally corruption, its that lobbying is an expensive form of petition, which makes its community of users overlap considerably with the set of people/groups with the resources to _effectively_ engage in corruption independently of whether or not they were using an intermediary to do advocacy to public representatives.

<comment><USER11> It seems to me the truth of corruption versus petition is if the politician sells their vote for cash or actually listens to the merits and makes a decision.

Now that is hard to judge from the outside, but that is the real difference.

I suspect many people believe those in power now are mostly selling their vote for cash not making decisions based on the merit and just happening to side with those giving piles of cash because they heard those people give explanations of why favoring them was a good move for the country.

<comment><USER12> A few years later it is often not. But politicians can lie legally even if uncovered and documented in lengths afterwards. Funny fact: German president Horst Köhler had to resign from office for saying the truth.

</comment></comment></comment></comment></comment></comment><comment><USER13> I've thoroughly enjoyed watching House of Cards. Sure it's not accurate, exactly. But what it does emphasize so well is the difference in pursuing money versus power. The latter can be bought by wooing lobbyists. Money itself is harder to gain and generally more associated with the developing world's modes of corruption. Are they so different? Not exactly. However one difference is power is less easily extractive than wealth. As an example: A wealthy corrupt official will likely pull money out of the system and into their own private offshore account. A politician using lobbying money to ascertain power in exchange for political direction is not banking money outside the system. Of course the lobby-backing commercial interests are, indirectly. But at least these companies are focused on more than sheer family-enrichment. Still, I wish we had a better system.

</comment><comment><USER14> What upsets me most is that now they're using lobbying for stuff that are clearly against our interest, such as diluting privacy restrictions and fighting against restrictions on Internet surveillance, even though in their press releases they make it sounds like they would do the opposite, and would fight against Internet surveillance:

[http://www.vice.com/read/are-google-and-facebook-just- preten...](http://www.vice.com/read/are-google-and-facebook-just-pretending- they-want-limits-on-nsa-surveillance)

<comment><USER15> is public / general interest the sum of all private / personal interests? that's a fundamental question.

</comment></comment><comment><USER16> If the government were confined to its proper function, companies would not have to attempt to influence it.

<comment><USER17> If you look at nations around the world, there is no consistent correlation between the powers of a central government and its state of corruption. For example the Afghan government is very weak, yet is still very corrupt.

<comment><USER5> >If you look at nations around the world, there is no consistent correlation between the powers of a central government and its state of corruption. For example the Afghan government is very weak, yet is still very corrupt.

I would expect, without looking at data, that the relationship is the reverse: More corrupt governments are weaker. This data seems to bear it out:

[https://en.wikipedia.org/wiki/Corruption_Perceptions_Index](https://en.wikipedia.org/wiki/Corruption_Perceptions_Index)

<comment><USER17> That was my thinking as well but Russia breaks the correlation-- very strong government, high perception of corruption.</comment></comment></comment></comment>


Entrepreneurs can change the world [Video] - <AUTHOR> http://www.youtube.com/watch?v=T6MhAwQ64c0&eurl=http%3A%2F%2Fmeghan%2Enonsociety%2Ecom%2F&feature=player_embedded

<comment><USER2> Posted some days ago, some discussion already at:

<http://news.ycombinator.com/item?id=609206></comment>


Ask HN: What Products Have Documentation? - <AUTHOR> I'm working on writing some developer documentation and looking for excellent docs. What products have amazing documentation? (besides Stripe, which we all love)<p>I'm personally interested in cases where the product is especially complicated, but let's keep the discussion explicitly general. <comment><USER2> I used to like Twitter Fabric's docs. It was so straightforward it was practically copy-paste. Facebook does similar well with their APIs.

PHP has really good documentation, compared to say, JS. On the other extreme,

Android has the worst, so bad that the unofficial documentation is Stack Overflow and this: [https://guides.codepath.com/android](https://guides.codepath.com/android)

Parse's has a few holes in it. But overall I like it because it highlights lesser known features like their many-to-many data structures and security ACL, and straight up tells you how to use them without being too wordy. [https://docs.parseplatform.org/android/guide/](https://docs.parseplatform.org/android/guide/)

</comment><comment><USER3> Postgres has excellent documentation.

[https://www.postgresql.org/docs/](https://www.postgresql.org/docs/)

</comment><comment><USER4> [https://news.ycombinator.com/item?id=17399340](https://news.ycombinator.com/item?id=17399340)

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER5> Say what you like about Bootstrap as a framework, but the documentation is pretty damn good for it. Every aspect of the system is documented, there are plenty of examples where needed, and its written in such a readable way that even novice web developers can understand everything pretty much immediately.

</comment><comment><USER6> Probably not the flavor you are looking for. But both Matlab and especially Mathematica have excellent docs. You can I think browse these for free online. Though part of what makes the docs excellent is that they integrate right into the IDE.

</comment><comment><AUTHOR> Haha, I just realized the typo in the title. "What products have documentation?" \-- most of them.

</comment><comment><USER7> [https://doc.qt.io/](https://doc.qt.io/)</comment>


The serial and the circumstantial entrepreneur - <AUTHOR> http://ohashi.info/article/serial-and-circumstantial-entrepreneur-two-types-entrepreneurs

<comment><USER2> Great article. . .

One of the questions from the bottom of the article: What needs to be taught in that 'teachable moment'?

I would say that learning to find solutions constructively with good outcomes is the most important skill an entrepreneur can learn because that's why they are entrepreneurs in the first place.

I think the process of finding solutions is important and exhilarating to entrepreneurs. Solving problems and making it through crises are almost physiologically addicting.

As a teacher I find myself easily bored with routine and constantly redesigning my lessons or approaches to problems with students. Some of that tinkering results in great solutions, other aspects of constant adjustment are not good for a classroom and a lot of stress results. With experience I'm learning to pick my spots for trying new things, but the thing I like best about teaching is finding new ways to help kids learn. I love to make new things happen.</comment>


Teaching yourself about structural racism will improve your machine learning - <AUTHOR> https://academic.oup.com/biostatistics/advance-article/doi/10.1093/biostatistics/kxz040/5631851 <comment><USER2> I think beyond not feeding race in as a _feature_ to any model, this stuff is mostly nonsense. If you include race as a feature, then I think it's likely that the model will become racist, because race is so highly correlated to behaviors and patterns which are in large part the consequence of all sorts of things, including historical racism, that a model could easily mistake race as a causal factor. If you don't feed race in as a feature, however, the outputs are hardly racist. My impression has been that by and large the argument _actually_ being made is that "we have been trying to correct for historical injustices by actively using race and gender as mechanisms for advantaging minorities and women, and an unbiased model is not properly accounting for these particular objectives."

Take something like a bank loan. If you had a model at a bank which took credit score, income, wealth, and collateral into account, black Americans would have loans rejected at a higher rate than white Americans. Is this model racist? No, this model doesn't even know what race is, all it knows is credit scores, income, wealth, and collateral. Does the fact that black Americans used to be slaves in the US, or were kept out of certain housing markets, contribute towards the fact that black Americans, on average, have lower credit scores, income, wealth, and collateral? Of course. But is this model racist? Literally not at all. It is completely unbiased, and exactly what the model _should_ be. If the case you're making is that you think that there should be a national effort to correct for historical injustices that were done by the state by actively discriminating by race, that is a _completely_ different discussion.

Having all of our decision-making apparatuses factor in the infinite pile of historical injustices that may have contributed to an individual's particular circumstances is not the way to go. Keep models simple and limited to what is relevant for that particular criteria. Fix injustices further upstream, or you make the whole system a convoluted nightmare.

<comment><USER3> _If the case you 're making is that you think that there should be a national effort to correct for historical injustices that were done by the state by actively discriminating by race, that is a completely different discussion._

That _is_ what proponents of the structural racism model are doing. Here's an example I took from the book _Weapons of Math Destruction_ :

When people are convicted of a crime, they undergo a number of personality tests, including the LSI-R (Level of Service Inventory - Revised). This is a highly detailed questionnaire that asks about prior convictions, whether the prisoner had accomplices in their crimes, whether drugs or alcohol were involved, etc.

It does not ask about race.

What it does ask about are things which highly correlate with race, such as the number of police encounters (no criminal suspicion necessary), the number of friends/family/neighbours who have committed crimes, etc. If two first-time offenders have committed identical crimes but one of them grew up in wealthy suburbs and the other grew up in the rough inner city, they will receive very different scores on the LSI-R.

So what do they use the LSI-R for? They feed it into a model which assigns the offender a recidivism risk score. Then they use that risk factor directly when determining the person's sentence, restrictions, parole eligibility, etc.

So now we're not even talking about historical injustices, we're talking about _ongoing injustice_ based on historical injustice. It's a vicious cycle, or a negative feedback loop, if you will. This is a serious problem!

Edit: Just to add another piece of the puzzle, the reason wealthy suburbs vs rough inner cities correlate so highly with race is a direct result of the historical racist practices of redlining [1] and white flight [2]. Now combine that with grinding poverty (also a result of redlining and segregation) and the war on drugs, and the result is high-crime neighbourhoods in the inner city. Those high crime neighbourhoods attract highly increased police presence, which leads to more convictions, which leads to more patrols, etc. This is another vicious cycle which feeds into the above statistical model.

[1] [https://en.wikipedia.org/wiki/Redlining](https://en.wikipedia.org/wiki/Redlining)

[2] [https://en.wikipedia.org/wiki/White_flight](https://en.wikipedia.org/wiki/White_flight)

<comment><USER2> I assume that the LSI-R is something that is actually trained based off of how much those factors actually predict the rate of recidivism, though, no? If friends/family/neighbors who have committed crimes is an accurate predictor of recidivism, the fact that black Americans in the inner city have more friends/family/neighbors who have committed crimes does not make the model racist. They're either good predictors or they're not. A black kid in the inner city with friends/family/neighbors who have committed crimes very likely _does_ have a higher rate of recidivism than a white kid in the suburbs, and if this weren't true, but was being predicted by the model, then this would simply be a bad model. If it turns out that there are many black kids who happen to live near neighbors who've committed crimes, but actually do not have a higher rate of recidivism, then the model is as racist as it is using a poorly correlated indicators of recidivism.

Your indicator for whether or not a model is racist cannot simply be that the model produces outputs that are delineated by race in such a manner that is unpalatable. So long as the model is actually not using race as a means of predicting outcomes, though, any behavior that is racist would simply be due to including poor features.

<comment><USER3> I think you're still missing the point. Whether the model is accurate or not is beside the point. A completely accurate model may indeed show a higher recidivism risk for an inner city kid compared to one from the suburbs. If it's used in sentencing or other life-affecting decisions then it's going to _amplify_ historical injustices.

People commit more crimes when they have less opportunity. People have less opportunity when they grow up in high crime neighbourhoods. This is a negative feedback loop which was started by slavery and accelerated by segregation and redlining.

It's not enough to use a hands-off approach. To correct the problem requires an active push in the opposite direction, to restore opportunity and break the cycles.

Edit: Think of it this way. You and some friends are playing Monopoly, drinking a few beers and having a great time. An hour and a half into the game (we all know games of Monopoly can last 4 hours or more), you discover one of your friends has been cheating. Now what?

He says "Sorry everyone! I'll stop cheating now and everything will be fine."

Is that true? Of course not. The proceeds from cheating may have been used to acquire the orange properties and maybe even put houses up on them. Every time you and the other friends land on those properties you end up paying rent to the previously cheating friend. Rent that he should not be collecting because those assets were acquired by cheating.

This is what it's like to have historical injustices continue to perpetuate into the future.

<comment><USER4> Yes, but you can't build it into your model. In this example, you would end up with a result of putting people back into these communities who have a high level of recidivism. You are actively _not_ avoiding an actual issue because of perceived racial injustice when the issue is not racial.

This is the problem with processing our world down racial lines. You're trying to correct for a _historical_ injustice. The fact that race factors into the circumstance of why people are where they are right now doesn't change the fact that those variables lead to recidivism. It's not racist. It's accurate.

If you want to fix the problem, then you need to fix the underlying issues, which tend to be economic. Those economic issues stem from an issue that affects all races, and therefore splitting it across racial lines only serves to reduce the possibility of actual change.

All you're doing when you try to account for historical injustice is slapping a band-aid on a deeper issue.

(Edit: Grammar)

<comment><USER3> I agree with you when it comes to the model: the model should be as accurate as possible. The big question is what to do with the model. The way it's being used now, the model is kind of a self-fulfilling prophecy. A prediction of high recidivism risk leads to a longer sentence which increases the likelihood of recidivism. This creates a feedback loop which increases real recidivism risk and the model changes to reflect that. If your goal is to reduce crime in society, then this may be a flawed approach.

<comment><USER4> Yes but that's not about race, that's about how we deal with crime as a society. These things aren't being unfairly applied to minority communities and that's the point. The system would be working the same way for a non- minority community, and it does, where the economic situation is similar.

That's why the racial angle is a waste of everyone's time and energy. It's not the relevant issue. The more relevant issue is how we deal with crime prevention. Currently, we go with a punishment approach rather than a truly rehabilitative one. This also has a lot to do with economics, and lobbying and private prisons and so on. It's much more complicated than 'everybody's racist'.

<comment><USER3> The purpose of the term _structural racism_ , instead of just _racism_ , is to distinguish the theory of historical racism and its downstream effects from the category people who hold views of racial superiority.

Besides that, there are plenty of people around today who actually are racist and they are major proponents of punishment-based approaches. If you try to switch to rehabilitation and intervention, they will resist you. They hold views that some races are innately of lower intelligence and have higher criminal tendencies. You aren't going to counteract that pressure by saying "the racial angle is a waste of everyone's time."

<comment><USER4> Yes, but what relevance does structural racism have to the _model_?

That's only true only if you believe the majority of people are racist. I don't.

There's also a number of ways that you don't even have to interact with that argument. You can show that the end results. It's not like we don't already have the studies and statistics that show how to resolve these issues. You can easily say to someone who thinks that way 'ok sure, you go on believing that, but even if you do believe that, there are still better ways to resolve this.'

Also most people are actually pretty receptive to new information if you are capable of packaging it well, and acknowledging their biases without judging them for it.

<comment><USER3> It doesn't take a majority of people in anything to create a problem. It only takes a concerted effort by a minority and complacency from the rest.

But besides this, we have too many people fighting a tug-o-war over the term racist. Some people want to apply the word to everyone. Other people think it should only apply to literal Nazis.

But again, that's a distraction. The membership in the Nazi party was around 8.5 million in 1945, yet the population of Germany was around 90 million at the time. That's right, less than 10% of the population were Nazis, yet they controlled everything.

<comment><USER4> What I'm saying is that the focus on race is counterproductive because it's thoroughly irrelevant to the solution. If you have one group blaming minority failure on their race, and another group saying that the failure is because of racism, the conversation revolves around race. We look to racially based solutions, and miss what's right in front of our nose. We assume that the issue is racial when it's not. That's what I mean by distraction.

The topic should be 'How do we fix crime, recidivism, and poverty?'. Pointing out historical injustice does absolutely nothing. There is no reasonable thing to do if that's your focal point, because the only ways to 'resolve' it is what? Reparations? Making decisions about jail time and release based on race? It's illogical. You'd end up putting people with high levels of recidivism back into a community, only serving to repeat the cycle, because you never actually look at the real problem. The things that cause that recidivism. The things that are _actually_ causing it _right now,_ instead of the reasons that it happens to be black people. If history were different, it could have been _anybody_. It could have been white people, brown people, any color, any ethnicity. It explains why the people in this situation are black more often than they are not, but it does not explain how we _fix_ the problem.

It is an absolute waste of time, and the real issue is that while we screw around talking about pointless grievances people will continue to go to jail, and die, because we're still not talking about _the problem._

Edit: I realized that this wasn't quite a response to your last post, but the relevancy is that you will only get complacency if you're focusing on things that can't really be fixed, or that essentially blame others, but what you can do is draw parallels, and essentially say 'Your issues are my issues too, and we can and should work together on them,' which is also true.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I did research briefly in a lab studying heart rate variability. HRV is a really interesting statistic in predicting heart health outcomes, and very interesting is the racial difference in HRV.

Basically, African Americans exhibit much higher heart rate variability, meaning their nervous system is much quicker to react to stimuli (quicker time to fight or flight response, for example) and this still isn't well understood in the field.

A naive understanding is that racial physiology is just different. And plenty of people will stand by this. However, self reported stress scores offer some insight into the difference.

High stress African Americans with High HRV lived as long as Low stress, low HRV White/Asian Americans. Most likely, the process by which the nervous system regulates itself is heavily influenced by life course events.

Medical science, in my experience, lacks in quantifying these social factors, and too often underplays their significance in determining physiological differences. Humans are incredibly dynamic systems, and the case can be made that we adapt to stimuli in order to survive. It's certainly possible that the physiological difference we observe in different racial populations is due to survival based on this principal.

It's only recently that I've seen research trying to get at these social/physiological mechanisms, but as far as funding is concerned, hard biological sciences are more interesting. Everyone just wants to edit the genome and call it a day, but I think we could get much further if we understood how life events lead to physiological ailments later in life.

<comment><USER6> Thank you for mentioning this.

>quicker time to fight or flight response

If cops are more likely to stop you because of your skin color (also further increasing the chances of further abuses), that would probably have an impact on your physiology over time.

[https://www.nationalgeographic.com/magazine/2018/04/the- stop...](https://www.nationalgeographic.com/magazine/2018/04/the-stop-race- police-traffic/)

<comment><USER5> Interestingly enough, I transitioned to gun violence research, which is what I do now, after wondering something along these lines.

If you live in a neighborhood where gun violence is a common occurrence, do you still get startled when you hear gunshots? If so, this would have a physiological effect, because it breaks your rhythm in an abrupt way, and does so at the frequency of hearing gun shots.

Obviously this is highly theoretical, but if true it would mean that just being in the proximity of violence puts you at an extra health risk, one that very few people would assume.

<comment><USER6> From personal experience myself and with friends, the level by which you are "startled" is in direct proportion to the proximity of the gunfire.

e.g. Hearing gunshots in the distance, you recognize they are gunshots, take note, but continue on your way. Hearing gunshots on your block or within a group you are in, you take immediate notice and react accordingly. But in either case, any time you hear them, is a reminder that the underlying fear never leaves.

</comment></comment></comment></comment><comment><USER7> > 4\. Conclusion "...grounding one's work in an understanding of structural > racism will improve model accuracy..."

It is not an interesting result to say models not modeling reality are less accurate; the cogent discussion is to what degree systemic racism exists IN reality. This is textbook begging the question.

> Acknowledgements: Conflict of Interest: None declared.

> Funding: Whitney R. Robinson is supported by the National Institute of > Minority Health

I am not familiar with standards of conflict declaration, but this looks like a pretty clear conflict of interest to me.

</comment><comment><USER8> This paper fails to account for (or even mention) genetics. To expand on the breathing capacity example, consider the case of the sherpas.

[https://www.npr.org/sections/goatsandsoda/2017/05/28/5302041...](https://www.npr.org/sections/goatsandsoda/2017/05/28/530204187/the- science-behind-the-super-abilities-of-sherpas)

</comment><comment><USER9> The real problem is that there are mutually exclusive desiderata from your models.

1\. If you have two people with identical relevant behavior and different races, you want the model to score them identically.

2\. Each race should receive a comparable distribution of scores.

3\. The scores should be as accurate of a predictor of ground facts as possible.

Relax the first desiderata and your model is now either explicitly or implicitly (via irrelevant proxy variables) using race to determine results, opening you up to racial discrimination lawsuits. Relax the second desiderata and your model is now creating disparate impact across racial groups, opening you up to racial discrimination lawsuit. Relax the third and you're leaving accuracy, and thus money, on the table.

</comment><comment><USER10> Disparate impact of results is NOT proof of racism. People are complicated - and some racial correlations are perfectly valid - at least until enough members of a racial group decide to change them...

</comment><comment><USER11> "Conflict of Interest: None declared."

In an article about structural racism, I would have expected more here.

<comment><USER12> A bias is not the same thing as a conflict of interest.

</comment></comment><comment><USER13> This post was on the front page 10 minutes ago but now it can't be found anywhere. It's pretty disappointing that it has been removed solely on the basis of being about race or being controversial. Race and racism are a part of society and it presumably made it to the front page because it's a topic that enough people found interesting to vote for...so why remove it?

<comment> Digit-Al It hasn't been removed. I can see it at position 43 at the moment, but it is showing as flagged for some reason.

</comment></comment><comment><USER14> People of every race find success in technology and in America more broadly. Many of these people's ancestors came to America with nothing. Those groups which find more success than average generally have a cultural focus on education and other behaviors associated with responsible action. Groups that don't succeed generally do not share these qualities.

It is these cultural differences which cause most of the group disparity in America, not "structural racism", yet the "critical race theorists" (race hustlers and grievance mongers) and their followers ignore these major factors and replace them with straw men.

In order to fix a problem, it's important to understand the actual causes. The sociologists and other assorted race hustlers will only divide us and lead us astray.

</comment><comment><USER15> The definition for structural racism according to the article:

> Structural racism refers to "the totality of ways in which societies foster > [racial] discrimination, via mutually reinforcing [inequitable] > systems...(e.g., in housing, education, employment, earnings, benefits, > credit, media, health care, criminal justice, etc.) that in turn reinforce > discriminatory beliefs, values, and distribution of resources," reflected in > history, culture, and interconnected institutions (Bailey and others, 2017).

I think I might be misunderstanding, but given this includes "culture", is this so sufficiently broad such that hypothetical scenarios such as this (no idea if this is accurate) would be captured "white people are culturally more likely to use crystal meth than other racial groups, ergo they are victims of (a certain kind of) systemic racism"?

It seems like this is just a catchall for any kind of error associated with a racial group, and the article is merely cautioning against such errors. If so, it begs the questions "why not just say so?" and "why use such a loaded term like systemic racism?".

<comment><USER16> Modern sociology in no way resembles a scientific study and is heavily politicized. A bunch of nonsense political "researchers" citing each other in drivel papers desperate for relevance.

It's now leaking into other fields. I remember when I first heard stem be changed to steam to include "arts" a laughed at how inclusive and utterly useless it is.

<comment><USER17> Postmodern sociology is revisionist towards trying to see society only through a lens that is also easily probable to be statistically sound, this is because of how more quantitative socioeconomic theories failed to predict very big crises or events in society. It can be argued that asking for scientific rigor in sociology to the same extent as in other human sciences raises the bar too much because to validate some theories the experiments are either impossible, prohibitively expensive, or so massive that they would bias the whole of society.

Also, I think it would marvel you knowing how much things you would call "scientific study" are also heavily politicized.

If this bothers you to a big extent I would recommend you try to find comfort in thinking about postmodern sociology as a religion different than yours. They won't be bothered by it and it will probably fit your mindset in a more soothing way than thinking about them as scientists. It's not that they are trying to publish their findings in ACM TOPLAS or something, they have their own community and books and kinda like it.

<comment><USER16> If it was treated as religion instead is science I would be open to that, but the papers churned out by "experts" today become policy tomorrow that effect everyone.

<comment><USER17> Religions dictate and have been dictating policy since forever we had governments and even before that. It's what people understand and mostly everyone seems to be ok with it.</comment></comment></comment></comment></comment>


Bitcoin Brainwallet - <AUTHOR> http://www.forbes.com/sites/jonmatonis/2012/03/12/brainwallet-the-ultimate-in-mobile-money/

<comment><USER2> Users mostly can't be trusted to produce reasonably constructed 8 character passwords even when there are complexity requirements. So it's rather surprising to hear that now it's a good idea to fully derive the key protecting your spends like cash edollars based off of a pass phrase that's simple enough they feel comfortable committing it to memory. Hint: you'll find a signifiacnt number of pass phrases if you brute force with only phrases out of popular books people will have lying around. You don't even need to wait for them to make their key first - since this is effectively unsalted go ahead and generate your bitcoin brainwallet rainbow tables ahead of time. Then just set your bot to watch for keys in use that you've previously generated. Hell, consider that this is effectively like having a website that only asks for pass phrase for login and no username - given how many people pick password1 as their passwords you're almost sure to see people colliding accidentally with the first 16 words in their favorite psalm or chapter 6 of the twilight book.

It's really easy to keep your keys secure and off disk and still be able to use great entropy - they're called smart cards.

<comment><USER3> You're right, but I think you miss the point of this article.

The point is that one _could_ store in his brain all the information needed to pay and receive any amount of money, without needing any extra storage device.

Because this money is Bitcoins, and because they are not stored anywhere, it technically means that all your money, all your wealth, resides in your brain - hence the title "Brainwallet".

This is a fascinating thought experiment, but not an assessment of the most secure way to store money.

<comment><USER4> Can't wait for the opportunity to lose my entire savings in a two-minutes backstreet incident.

Better use this only for the equivalent of todays's purse with as much cash as you feel you need for the next few days.

See also <http://news.ycombinator.com/item?id=2551397> for how to mitigate such risks.

</comment></comment></comment><comment><USER5> This passphrase-for-a-chain-of-private-keys idea is a nice one, and it lends itself to a bunch of privacy-related plausible deniability scenarios.

In crypto (especially when there's money involved) it's typical to imagine attackers with lead pipes and your knees in the mix; it's nice to imagine you could 'crack' and give up your stash, except it's not really your stash, it's just a little stash.

There are a bunch of other security factors at work here, though. Consider that you need to have a computer you KNOW does not have a keylogger on it, for instance.

The loss vectors for Bitcoin historically have been

a) Client bugs b) System password attacks c) 'errors' or theft by plausibly denying operators

These actually can all be mitigated, but not well with current systems. The master generator password is a good addition to the toolkit, but it's not going to be sufficient. So, let's not forget that cool crypto is as strong as its weakest link.

I've been considering how you'd safely allow frequent $1mm+ transactions with Bitcoins recently, and my list involves an unplugged from the net computer, a faraday cage and a professional auditor from one of the big four.

<comment><USER5> I wrote a lengthier set of thoughts up at my G+ account: [https://plus.google.com/112885659993091300749/posts/bD4FNxN8...](https://plus.google.com/112885659993091300749/posts/bD4FNxN8ox9)

</comment></comment><comment><USER6> "I'm sorry, doctor, I'd like to pay you for the emergency brain surgery, but since the accident I can't remember my money."

<comment><USER7> store the key in case of amnesia.

</comment></comment><comment><USER8> So when are we going to see dedicated Bitcoin hardware? Most of the security problems with Bitcoin arise from using the software on general purpose computers, which don't mind if arbitrary processes examine the memory of the Bitcoin client. Trusted Platform Modules and smartcard chips, on the other hand, can encrypt incoming data without leaking the private key. You'd only need a couple thousand more gates (WAG) to run Bitcoin on secure silicon.

In fact, this is such a patently obvious insight that someone else must have thought of it already.

<comment><USER9> There have been discussions on the forum, but nothing serious. (There's specialized Bitcoin mining hardware, but we're talking about wallet storage here.) I don't think a smartcard is really enough; you need something like the IBM ZTIC, and it's not clear that people are willing to pay for that. There was some discussion about using trusted computing: <https://bitcointalk.org/index.php?topic=67508.0>

</comment></comment><comment><USER10> It's scary to think that it that method goes mainstream any robber would simply need to point a knife to me and say: give me your brainwallet.

</comment><comment><USER11> tldr: master passphrase

<comment><USER12> It's more than that, though -- the bitcoin private key isn't _encrypted with_ the passphrase, it's _generated directly_ from the passphrase. So there's no data on disk; only data in your mind.

</comment></comment><comment><USER13> _Seemingly random modifications of the phrase would aid in strengthening brainwallet, such as "I went seeking freeeedom, but all the world's issslands were alreaDy taken." These simple changes make the entire phrase very difficult to predict._

No they don't! Probability does not work that way!

<comment><USER14> Yes it does. A priori, P("freeeedom") << P("freedom"). This decreases the probability that an attacker will stumble across your passphrase using anything other than a pure brute-force approach (more on that below). Further, though not completely what you're talking about, English has huge amounts (~50%) of redundancy in its structure. It's a tremendously easier problem to attack the passphrases with knowledge of the statistical structure of English, if that's actually a good assumption to make. For example, the prior probability of an unknown word in a sentence being "freedom" is X, but when you know that the three preceding words are, "I went seeking", the probability of the unknown word being "freedom" becomes Y > X. Beyond misspellings, reordering words (say, German-style verb inversion) might also be effective in thwarting this compression while still being easy to remember. [1]

If you want to brute force your way through, sure, there's no difference in the example sentences given. Brute force is a totally ridiculous proposition given the length of the secret involved [2], though, so you're banking on people preserving language structure to aid in memorization to constrict your search space. Otherwise you're basically screwed (not that you aren't basically screwed anyway if the sentence is really not derived from literature and 10 words long).

[1] For more, this is what you're looking for: [http://cm.bell- labs.com/cm/ms/what/shannonday/shannon1948.pd...](http://cm.bell- labs.com/cm/ms/what/shannonday/shannon1948.pdf)

[2] <http://xkcd.com/936/>

<comment><USER13> The error is in assuming that applying a simple permutation to a word increases the entropy by a meaningful amount. Capitalizing a letter, substituting a symbol, moving your hand's position on the keyboard, or repeating a letter are _common_ things to do. A dictionary word that has had one of these things done to it, for purposes of password strength, _is still a dictionary word_.

People commonly think they are being random when they modify their passwords, but in point of fact, they are doing the same thing as everyone else. You cannot ever trust yourself to be random; the only things you can trust to be random _come out of random number generators_.

That is why I say probability does not work that way. In order for a modification to make a password or phrase meaningfully secure, it must come from a genuinely random source with a large number of live outcome possibilities. Mutating a phrase in a clever, original way that everyone else uses is pointless. It does not make the passphrase "very hard to predict". It makes it "slightly less hard to predict than it was, which was not very hard in the first place."

Fundamentally, "probability does not work that way" in the sense that just because the outcome _looks_ random and the process _feels_ random, that doesn't mean it _is_.

<comment><USER14> > Capitalizing a letter, substituting a symbol, moving your hand's position on > the keyboard, or repeating a letter are common things to do. A dictionary > word that has had one of these things done to it, for purposes of password > strength, is still a dictionary word.

For single-word passwords it can be approximated this way. However, for anything longer, especially a natural language sentence, misspellings makes a big difference.

The OED documents 171,146 words in active use. Assume that every word has at least two simple mispellings. Suddenly your dictionary becomes 513,438 words big. This is a linear expansion, but it's in the exponent since you're taking permutations. That's a big deal. Some mispellings may be much more common than others, so you can bias your dataset accordingly, but it's still a huge expansion.

> You cannot ever trust yourself to be random; the only things you can trust > to be random come out of random number generators.

This is true, but neither really here nor there. The entropy of the passphrase is already so great, and then is expanded exponentially with the addition of misspellings and substitutions, even if the distribution of those is biased.

<comment><USER15> > _"for anything longer... misspellings makes a big difference."_

The question to ask is, how big a difference? Put another way, how many bits of entropy do your misspellings generate?

In your above example, where each word has 2 common misspellings, each misspelling gets you ~1.5 bits of entropy. For comparison, adding another randomly selected OED word gets you just over 17 bits of entropy. If we're talking about making _meaningfully stronger_ passwords, making a grammatically correct phrase and then adding misspellings (what the article calls "seemingly random modifications") is a _less effective strategy_ than simply using a series of actually-random words from the OED.

It's better to add entropy 17 bits at a time (whole words) than trying to add entropy piecemeal, 2 bits here and 3 bits there (misspellings, punctuation).</comment></comment></comment></comment></comment>